<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - iOS 10 video player does not send HttpOnly cookies; missing test coverage"
href="https://bugs.webkit.org/show_bug.cgi?id=161780">161780</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>iOS 10 video player does not send HttpOnly cookies; missing test coverage
</td>
</tr>
<tr>
<th>Classification</th>
<td>Unclassified
</td>
</tr>
<tr>
<th>Product</th>
<td>WebKit
</td>
</tr>
<tr>
<th>Version</th>
<td>Other
</td>
</tr>
<tr>
<th>Hardware</th>
<td>iOS
</td>
</tr>
<tr>
<th>OS</th>
<td>Other
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>Major
</td>
</tr>
<tr>
<th>Priority</th>
<td>P2
</td>
</tr>
<tr>
<th>Component</th>
<td>Media Elements
</td>
</tr>
<tr>
<th>Assignee</th>
<td>webkit-unassigned@lists.webkit.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>fabian@tag1consulting.com
</td>
</tr></table>
<p>
<div>
<pre>Created <span class=""><a href="attachment.cgi?id=288370" name="attach_288370" title="Adds the missing test coverage for HttpOnly cookies.">attachment 288370</a> <a href="attachment.cgi?id=288370&action=edit" title="Adds the missing test coverage for HttpOnly cookies.">[details]</a></span>
Adds the missing test coverage for HttpOnly cookies.
OS had a nasty bug in iOS 7.0.4, where cookies had been missing for requests send from VideoPlayers. (Original openradar: <a href="http://openradar.appspot.com/radar?id=5238098090786816">http://openradar.appspot.com/radar?id=5238098090786816</a>; test script: <a href="https://www.bizify.me/test-if-your-ios-device-is-broken/">https://www.bizify.me/test-if-your-ios-device-is-broken/</a>)
This bug is back in iOS 10 (Visit: <a href="https://www.bizify.me/test-if-your-ios-device-is-broken/">https://www.bizify.me/test-if-your-ios-device-is-broken/</a>), though neither Safari nightly nor Safari Technology preview are affected.
This time however only the Javascript allowed cookies are send to the server, not the HttpOnly cookies.
This test coverage is missing in WebKit as well, because it also does not specifically test for HttpOnly cookies, which usually are excluded from client side Javascript.
Patch is attached to fix the test coverage at least, but should be fixed in iOS 10 ASAP as it makes authentication of users for Videos impossible again.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>